ISA Server Configuration Options for Hotmail Access When You Use Outlook Express

When you try to configure Microsoft Outlook Express to retrieve e-mail messages from Microsoft MSN Hotmail through Internet Security and Acceleration (ISA) Server, you may receive one of the following error messages:

This issue occurs because Outlook Express might not be able to pass authentication credentials back to ISA Server if ISA Server is configured to allow access only to specific users.

To work around this issue, use one of the following methods.

Method 1

1. On the client computer, configure Microsoft Internet Explorer so that the necessary sites are exceptions to the proxy settings:
   1. In Internet Explorer, click Internet Options on the Tools menu, and then click the Connections tab.
   2. Click LAN Settings, and then click Advanced to display the Proxy Settings dialog box.
   3. Under Exception, type the names or addresses of the necessary sites, separated by a semicolon (for example, *.hotmail.com;*.msn.com).
2. On the client computer, install and enable the ISA Server firewall client by using one of the following procedures:
   • If you are using Microsoft Small Business Server 2000, use the Setup Computer Wizard from the Small Business Server Administrator console to add the firewall client to the client computer, and then have the user log off from and back on to the client computer.
   • Install the firewall client from the following ISA Server shared drive:
     \\Server_name\Mspclnt\Setup.exe
3. On the computer that is running ISA Server, configure the HTTP redirector filter to send to the requested Web server:
   1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
   2. Click the plus sign that is next to Extensions.
   3. Click the Application Filters folder.
   4. Double-click HTTP Redirector Filter.
   5. Click the Options tab, and then click Send to requested Web server.

Method 2

1. On the client computer, configure Internet Explorer so that it does not use a proxy server:
   1. In Internet Explorer, click Internet Options on the Tools menu, and then click the Connections tab.
   2. Click LAN Settings, and then click to clear the Use a proxy server check box.
2. On the client computer, install and enable the ISA Server firewall client by using one of the following procedures:
   • If you are using Small Business Server 2000, use the Setup Computer Wizard from the Small Business Server Administrator console to add the firewall client to the client computer, and then have the user log off from and back on to the client computer.
   • Install the firewall client from the following ISA Server shared drive:
     \\Server_name\Mspclnt\Setup.exe
3. On the computer that is running ISA Server, configure the HTTP redirector filter to send to the requested Web server:
   1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management
   2. Click the plus sign that is next to Extensions.
   3. Click the Application Filters folder.
   4. Double-click HTTP Redirector Filter
   5. Click the Options tab, and then click Send to requested Web server.

Method 3

1. On the client computer, configure Internet Explorer so that it does not use a proxy server:
   1. In Internet Explorer, click Internet Options on the Tools menu, and then click the Connections tab.
   2. Click LAN Settings, and then click to clear the Use a proxy server check box.
2. On the computer that is running ISA Server, configure protocol rules and site and content rules to apply to any request:
   1. Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
   2. Click the plus sign that is next to Access Policy.
   3. Click the appropriate folder: either Site and Content Rules or Protocol Rules.
   4. Double-click the appropriate policy.
   5. Click the Applies to tab, and then click Any Request.

Method 4

This method will only work if you are running a Windows 2000 Domain. This will allow you to still force authentication at the ISA server and leave the http filter as is (so that Firewall and SecureNAT clients can take advantage of the cache). The reason that hotmail using Outlook Express fails from behind ISA if you are forcing authentication is that Outlook Express sends the hotmail credentials, not the Windows credentials. The following work around takes advantage of this fact.

1. Go to AD Domains and Trusts, right click where it says "Active Directory Domains and Trusts" and choose properties. Add a new UPN suffix called hotmail.com.
2. Create a user with the same name and password as your hotmail account. Set the UPN for that account to the hotmail.com UPN created in the previous step.

This would need to be done for every client that accesses hotmail. It is recommended that the rights of these accounts be restricted, perhaps placing them in a special group. If you are using user/group access restrictions in ISA, make sure these users are granted access.

Microsoft has confirmed that this is a problem in Outlook Express version 5.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base: